package com.aphrodite.security;

/**
 * A class that provides Twofish encryption operations.
 * <p>
 * Two fish is s symmetric key encryption algorithm<br/> The key for a Twofish
 * crypto should not be less than 64 bits or greater than 256 bits.<br/>
 * <b>Performing two fish encryption</b><br/> <code>TwofishCrypto tfc=new
 * TwofishCrypto();<br/> byte[] key=... <font color="green">//Create a key that
 * is greater than 8 bytes(64bits) and less than 64 bytes(256bits)</font><br/>
 * tfc.init(true,key);<font color="green">//initialise the engine for
 * encryprion</font><br/> byte[] cipher=
 * tfc.encrypt("Aphrodite Rocks".getBytes());<font color="green">//Encrypting
 * plain text</font><br/> tfc.init(false,key);<font color="green">//initialise
 * the engine for decryption</font><br/> String plain =new
 * String(tfc.decrypt(cipher));<br/></code> This Java implementation is based on
 * the Java reference implementation provided by Bruce Schneier and developed by
 * Raif S. Naffah.
 * </p>
 */
public final class TwofishCrypto {
	private static final int BLOCK_SIZE = 16; // bytes = 128 bits

	/* Primitive polynomial for GF(256) */
	private static final int GF256_FDBK = 0x169;
	private static final int GF256_FDBK_2 = GF256_FDBK / 2;
	private static final int GF256_FDBK_4 = GF256_FDBK / 4;
	private static final int INPUT_WHITEN = 0;
	private static final int MAX_KEY_BITS = 256;

	private static final int MAX_ROUNDS = 16; // bytes = 128 bits
	private static final int OUTPUT_WHITEN = INPUT_WHITEN + BLOCK_SIZE / 4; // 4
	private static final byte[][] P = { { // p0
			(byte) 0xA9, (byte) 0x67, (byte) 0xB3, (byte) 0xE8, (byte) 0x04, (byte) 0xFD, (byte) 0xA3, (byte) 0x76,
					(byte) 0x9A, (byte) 0x92, (byte) 0x80, (byte) 0x78, (byte) 0xE4, (byte) 0xDD, (byte) 0xD1,
					(byte) 0x38, (byte) 0x0D, (byte) 0xC6, (byte) 0x35, (byte) 0x98, (byte) 0x18, (byte) 0xF7,
					(byte) 0xEC, (byte) 0x6C, (byte) 0x43, (byte) 0x75, (byte) 0x37, (byte) 0x26, (byte) 0xFA,
					(byte) 0x13, (byte) 0x94, (byte) 0x48, (byte) 0xF2, (byte) 0xD0, (byte) 0x8B, (byte) 0x30,
					(byte) 0x84, (byte) 0x54, (byte) 0xDF, (byte) 0x23, (byte) 0x19, (byte) 0x5B, (byte) 0x3D,
					(byte) 0x59, (byte) 0xF3, (byte) 0xAE, (byte) 0xA2, (byte) 0x82, (byte) 0x63, (byte) 0x01,
					(byte) 0x83, (byte) 0x2E, (byte) 0xD9, (byte) 0x51, (byte) 0x9B, (byte) 0x7C, (byte) 0xA6,
					(byte) 0xEB, (byte) 0xA5, (byte) 0xBE, (byte) 0x16, (byte) 0x0C, (byte) 0xE3, (byte) 0x61,
					(byte) 0xC0, (byte) 0x8C, (byte) 0x3A, (byte) 0xF5, (byte) 0x73, (byte) 0x2C, (byte) 0x25,
					(byte) 0x0B, (byte) 0xBB, (byte) 0x4E, (byte) 0x89, (byte) 0x6B, (byte) 0x53, (byte) 0x6A,
					(byte) 0xB4, (byte) 0xF1, (byte) 0xE1, (byte) 0xE6, (byte) 0xBD, (byte) 0x45, (byte) 0xE2,
					(byte) 0xF4, (byte) 0xB6, (byte) 0x66, (byte) 0xCC, (byte) 0x95, (byte) 0x03, (byte) 0x56,
					(byte) 0xD4, (byte) 0x1C, (byte) 0x1E, (byte) 0xD7, (byte) 0xFB, (byte) 0xC3, (byte) 0x8E,
					(byte) 0xB5, (byte) 0xE9, (byte) 0xCF, (byte) 0xBF, (byte) 0xBA, (byte) 0xEA, (byte) 0x77,
					(byte) 0x39, (byte) 0xAF, (byte) 0x33, (byte) 0xC9, (byte) 0x62, (byte) 0x71, (byte) 0x81,
					(byte) 0x79, (byte) 0x09, (byte) 0xAD, (byte) 0x24, (byte) 0xCD, (byte) 0xF9, (byte) 0xD8,
					(byte) 0xE5, (byte) 0xC5, (byte) 0xB9, (byte) 0x4D, (byte) 0x44, (byte) 0x08, (byte) 0x86,
					(byte) 0xE7, (byte) 0xA1, (byte) 0x1D, (byte) 0xAA, (byte) 0xED, (byte) 0x06, (byte) 0x70,
					(byte) 0xB2, (byte) 0xD2, (byte) 0x41, (byte) 0x7B, (byte) 0xA0, (byte) 0x11, (byte) 0x31,
					(byte) 0xC2, (byte) 0x27, (byte) 0x90, (byte) 0x20, (byte) 0xF6, (byte) 0x60, (byte) 0xFF,
					(byte) 0x96, (byte) 0x5C, (byte) 0xB1, (byte) 0xAB, (byte) 0x9E, (byte) 0x9C, (byte) 0x52,
					(byte) 0x1B, (byte) 0x5F, (byte) 0x93, (byte) 0x0A, (byte) 0xEF, (byte) 0x91, (byte) 0x85,
					(byte) 0x49, (byte) 0xEE, (byte) 0x2D, (byte) 0x4F, (byte) 0x8F, (byte) 0x3B, (byte) 0x47,
					(byte) 0x87, (byte) 0x6D, (byte) 0x46, (byte) 0xD6, (byte) 0x3E, (byte) 0x69, (byte) 0x64,
					(byte) 0x2A, (byte) 0xCE, (byte) 0xCB, (byte) 0x2F, (byte) 0xFC, (byte) 0x97, (byte) 0x05,
					(byte) 0x7A, (byte) 0xAC, (byte) 0x7F, (byte) 0xD5, (byte) 0x1A, (byte) 0x4B, (byte) 0x0E,
					(byte) 0xA7, (byte) 0x5A, (byte) 0x28, (byte) 0x14, (byte) 0x3F, (byte) 0x29, (byte) 0x88,
					(byte) 0x3C, (byte) 0x4C, (byte) 0x02, (byte) 0xB8, (byte) 0xDA, (byte) 0xB0, (byte) 0x17,
					(byte) 0x55, (byte) 0x1F, (byte) 0x8A, (byte) 0x7D, (byte) 0x57, (byte) 0xC7, (byte) 0x8D,
					(byte) 0x74, (byte) 0xB7, (byte) 0xC4, (byte) 0x9F, (byte) 0x72, (byte) 0x7E, (byte) 0x15,
					(byte) 0x22, (byte) 0x12, (byte) 0x58, (byte) 0x07, (byte) 0x99, (byte) 0x34, (byte) 0x6E,
					(byte) 0x50, (byte) 0xDE, (byte) 0x68, (byte) 0x65, (byte) 0xBC, (byte) 0xDB, (byte) 0xF8,
					(byte) 0xC8, (byte) 0xA8, (byte) 0x2B, (byte) 0x40, (byte) 0xDC, (byte) 0xFE, (byte) 0x32,
					(byte) 0xA4, (byte) 0xCA, (byte) 0x10, (byte) 0x21, (byte) 0xF0, (byte) 0xD3, (byte) 0x5D,
					(byte) 0x0F, (byte) 0x00, (byte) 0x6F, (byte) 0x9D, (byte) 0x36, (byte) 0x42, (byte) 0x4A,
					(byte) 0x5E, (byte) 0xC1, (byte) 0xE0 }, { // p1
			(byte) 0x75, (byte) 0xF3, (byte) 0xC6, (byte) 0xF4, (byte) 0xDB, (byte) 0x7B, (byte) 0xFB, (byte) 0xC8,
					(byte) 0x4A, (byte) 0xD3, (byte) 0xE6, (byte) 0x6B, (byte) 0x45, (byte) 0x7D, (byte) 0xE8,
					(byte) 0x4B, (byte) 0xD6, (byte) 0x32, (byte) 0xD8, (byte) 0xFD, (byte) 0x37, (byte) 0x71,
					(byte) 0xF1, (byte) 0xE1, (byte) 0x30, (byte) 0x0F, (byte) 0xF8, (byte) 0x1B, (byte) 0x87,
					(byte) 0xFA, (byte) 0x06, (byte) 0x3F, (byte) 0x5E, (byte) 0xBA, (byte) 0xAE, (byte) 0x5B,
					(byte) 0x8A, (byte) 0x00, (byte) 0xBC, (byte) 0x9D, (byte) 0x6D, (byte) 0xC1, (byte) 0xB1,
					(byte) 0x0E, (byte) 0x80, (byte) 0x5D, (byte) 0xD2, (byte) 0xD5, (byte) 0xA0, (byte) 0x84,
					(byte) 0x07, (byte) 0x14, (byte) 0xB5, (byte) 0x90, (byte) 0x2C, (byte) 0xA3, (byte) 0xB2,
					(byte) 0x73, (byte) 0x4C, (byte) 0x54, (byte) 0x92, (byte) 0x74, (byte) 0x36, (byte) 0x51,
					(byte) 0x38, (byte) 0xB0, (byte) 0xBD, (byte) 0x5A, (byte) 0xFC, (byte) 0x60, (byte) 0x62,
					(byte) 0x96, (byte) 0x6C, (byte) 0x42, (byte) 0xF7, (byte) 0x10, (byte) 0x7C, (byte) 0x28,
					(byte) 0x27, (byte) 0x8C, (byte) 0x13, (byte) 0x95, (byte) 0x9C, (byte) 0xC7, (byte) 0x24,
					(byte) 0x46, (byte) 0x3B, (byte) 0x70, (byte) 0xCA, (byte) 0xE3, (byte) 0x85, (byte) 0xCB,
					(byte) 0x11, (byte) 0xD0, (byte) 0x93, (byte) 0xB8, (byte) 0xA6, (byte) 0x83, (byte) 0x20,
					(byte) 0xFF, (byte) 0x9F, (byte) 0x77, (byte) 0xC3, (byte) 0xCC, (byte) 0x03, (byte) 0x6F,
					(byte) 0x08, (byte) 0xBF, (byte) 0x40, (byte) 0xE7, (byte) 0x2B, (byte) 0xE2, (byte) 0x79,
					(byte) 0x0C, (byte) 0xAA, (byte) 0x82, (byte) 0x41, (byte) 0x3A, (byte) 0xEA, (byte) 0xB9,
					(byte) 0xE4, (byte) 0x9A, (byte) 0xA4, (byte) 0x97, (byte) 0x7E, (byte) 0xDA, (byte) 0x7A,
					(byte) 0x17, (byte) 0x66, (byte) 0x94, (byte) 0xA1, (byte) 0x1D, (byte) 0x3D, (byte) 0xF0,
					(byte) 0xDE, (byte) 0xB3, (byte) 0x0B, (byte) 0x72, (byte) 0xA7, (byte) 0x1C, (byte) 0xEF,
					(byte) 0xD1, (byte) 0x53, (byte) 0x3E, (byte) 0x8F, (byte) 0x33, (byte) 0x26, (byte) 0x5F,
					(byte) 0xEC, (byte) 0x76, (byte) 0x2A, (byte) 0x49, (byte) 0x81, (byte) 0x88, (byte) 0xEE,
					(byte) 0x21, (byte) 0xC4, (byte) 0x1A, (byte) 0xEB, (byte) 0xD9, (byte) 0xC5, (byte) 0x39,
					(byte) 0x99, (byte) 0xCD, (byte) 0xAD, (byte) 0x31, (byte) 0x8B, (byte) 0x01, (byte) 0x18,
					(byte) 0x23, (byte) 0xDD, (byte) 0x1F, (byte) 0x4E, (byte) 0x2D, (byte) 0xF9, (byte) 0x48,
					(byte) 0x4F, (byte) 0xF2, (byte) 0x65, (byte) 0x8E, (byte) 0x78, (byte) 0x5C, (byte) 0x58,
					(byte) 0x19, (byte) 0x8D, (byte) 0xE5, (byte) 0x98, (byte) 0x57, (byte) 0x67, (byte) 0x7F,
					(byte) 0x05, (byte) 0x64, (byte) 0xAF, (byte) 0x63, (byte) 0xB6, (byte) 0xFE, (byte) 0xF5,
					(byte) 0xB7, (byte) 0x3C, (byte) 0xA5, (byte) 0xCE, (byte) 0xE9, (byte) 0x68, (byte) 0x44,
					(byte) 0xE0, (byte) 0x4D, (byte) 0x43, (byte) 0x69, (byte) 0x29, (byte) 0x2E, (byte) 0xAC,
					(byte) 0x15, (byte) 0x59, (byte) 0xA8, (byte) 0x0A, (byte) 0x9E, (byte) 0x6E, (byte) 0x47,
					(byte) 0xDF, (byte) 0x34, (byte) 0x35, (byte) 0x6A, (byte) 0xCF, (byte) 0xDC, (byte) 0x22,
					(byte) 0xC9, (byte) 0xC0, (byte) 0x9B, (byte) 0x89, (byte) 0xD4, (byte) 0xED, (byte) 0xAB,
					(byte) 0x12, (byte) 0xA2, (byte) 0x0D, (byte) 0x52, (byte) 0xBB, (byte) 0x02, (byte) 0x2F,
					(byte) 0xA9, (byte) 0xD7, (byte) 0x61, (byte) 0x1E, (byte) 0xB4, (byte) 0x50, (byte) 0x04,
					(byte) 0xF6, (byte) 0xC2, (byte) 0x16, (byte) 0x25, (byte) 0x86, (byte) 0x56, (byte) 0x55,
					(byte) 0x09, (byte) 0xBE, (byte) 0x91 } };
	/**
	 * Define the fixed p0/p1 permutations used in keyed S-box lookup. By
	 * changing the following constant definitions, the S-boxes will
	 * automatically get changed in the Twofish engine.
	 */
	private static final int P_00 = 1;
	private static final int P_01 = 0;

	private static final int P_02 = 0;
	private static final int P_03 = P_01 ^ 1;
	private static final int P_04 = 1;
	private static final int P_10 = 0;
	private static final int P_11 = 0;

	private static final int P_12 = 1;
	private static final int P_13 = P_11 ^ 1;
	private static final int P_14 = 0;
	private static final int P_20 = 1;
	private static final int P_21 = 1;

	private static final int P_22 = 0;
	private static final int P_23 = P_21 ^ 1;
	private static final int P_24 = 0;

	private static final int P_30 = 0;

	// ====================================
	// Useful constants
	// ====================================

	private static final int P_31 = 1;
	private static final int P_32 = 1;
	private static final int P_33 = P_31 ^ 1;
	private static final int P_34 = 1;

	private static final int ROUND_SUBKEYS = OUTPUT_WHITEN + BLOCK_SIZE / 4;// 8
	private static final int ROUNDS = 16;
	private static final int RS_GF_FDBK = 0x14D; // field generator

	private static final int SK_BUMP = 0x01010101;

	private static final int SK_ROTL = 9;
	private static final int SK_STEP = 0x02020202;
	private static final int TOTAL_SUBKEYS = ROUND_SUBKEYS + 2 * MAX_ROUNDS;// 40

	private boolean encrypting = false;

	private int[] gMDS0 = new int[MAX_KEY_BITS];
	private int[] gMDS1 = new int[MAX_KEY_BITS];
	private int[] gMDS2 = new int[MAX_KEY_BITS];
	private int[] gMDS3 = new int[MAX_KEY_BITS];

	private int[] gSBox;
	/**
	 * gSubKeys[] and gSBox[] are eventually used in the encryption and
	 * decryption methods.
	 */
	private int[] gSubKeys;

	private int k64Cnt = 0;

	private byte[] workingKey = null;

	public TwofishCrypto() {
		// calculate the MDS matrix
		int[] m1 = new int[2];
		int[] mX = new int[2];
		int[] mY = new int[2];
		int j;

		for (int i = 0; i < MAX_KEY_BITS; i++) {
			j = P[0][i] & 0xff;
			m1[0] = j;
			mX[0] = Mx_X(j) & 0xff;
			mY[0] = Mx_Y(j) & 0xff;

			j = P[1][i] & 0xff;
			m1[1] = j;
			mX[1] = Mx_X(j) & 0xff;
			mY[1] = Mx_Y(j) & 0xff;

			gMDS0[i] = m1[P_00] | mX[P_00] << 8 | mY[P_00] << 16 | mY[P_00] << 24;

			gMDS1[i] = mY[P_10] | mY[P_10] << 8 | mX[P_10] << 16 | m1[P_10] << 24;

			gMDS2[i] = mX[P_20] | mY[P_20] << 8 | m1[P_20] << 16 | mY[P_20] << 24;

			gMDS3[i] = mX[P_30] | m1[P_30] << 8 | mY[P_30] << 16 | mX[P_30] << 24;
		}
	}

	private final int b0(int x) {
		return x & 0xff;
	}

	private final int b1(int x) {
		return (x >>> 8) & 0xff;
	}

	private final int b2(int x) {
		return (x >>> 16) & 0xff;
	}

	private final int b3(int x) {
		return (x >>> 24) & 0xff;
	}

	private final void Bits32ToBytes(int in, byte[] b, int offset) {
		b[offset] = (byte) in;
		b[offset + 1] = (byte) (in >> 8);
		b[offset + 2] = (byte) (in >> 16);
		b[offset + 3] = (byte) (in >> 24);
	}

	// ==================================
	// Private Implementation
	// ==================================

	private final int BytesTo32Bits(byte[] b, int p) {
		return ((b[p] & 0xff)) | ((b[p + 1] & 0xff) << 8) | ((b[p + 2] & 0xff) << 16) | ((b[p + 3] & 0xff) << 24);
	}

	public byte[] decrypt(final byte[] cipher) {
		return decryptBytes(cipher);
	}

	/**
	 * Decrypt the given input starting at the given offset and place the result
	 * in the provided buffer starting at the given offset. The input will be an
	 * exact multiple of our blocksize.
	 */
	private void decryptBlock(byte[] src, int srcIndex, byte[] dst, int dstIndex) {
		int x2 = BytesTo32Bits(src, srcIndex) ^ gSubKeys[OUTPUT_WHITEN];
		int x3 = BytesTo32Bits(src, srcIndex + 4) ^ gSubKeys[OUTPUT_WHITEN + 1];
		int x0 = BytesTo32Bits(src, srcIndex + 8) ^ gSubKeys[OUTPUT_WHITEN + 2];
		int x1 = BytesTo32Bits(src, srcIndex + 12) ^ gSubKeys[OUTPUT_WHITEN + 3];

		int k = ROUND_SUBKEYS + 2 * ROUNDS - 1;
		int t0, t1;
		for (int r = 0; r < ROUNDS; r += 2) {
			t0 = Fe32_0(x2);
			t1 = Fe32_3(x3);
			x1 ^= t0 + 2 * t1 + gSubKeys[k--];
			x0 = (x0 << 1 | x0 >>> 31) ^ (t0 + t1 + gSubKeys[k--]);
			x1 = x1 >>> 1 | x1 << 31;

			t0 = Fe32_0(x0);
			t1 = Fe32_3(x1);
			x3 ^= t0 + 2 * t1 + gSubKeys[k--];
			x2 = (x2 << 1 | x2 >>> 31) ^ (t0 + t1 + gSubKeys[k--]);
			x3 = x3 >>> 1 | x3 << 31;
		}

		Bits32ToBytes(x0 ^ gSubKeys[INPUT_WHITEN], dst, dstIndex);
		Bits32ToBytes(x1 ^ gSubKeys[INPUT_WHITEN + 1], dst, dstIndex + 4);
		Bits32ToBytes(x2 ^ gSubKeys[INPUT_WHITEN + 2], dst, dstIndex + 8);
		Bits32ToBytes(x3 ^ gSubKeys[INPUT_WHITEN + 3], dst, dstIndex + 12);
	}

	public byte[] decryptBytes(final byte[] source) {
		encrypting = false;
		final int length = ((source[2] & 0xFF) * 256) + (source[1] & 0xFF);
		final int blocks = (length / BLOCK_SIZE) + (length % BLOCK_SIZE != 0 ? 1 : 0);

		final byte[] output = new byte[blocks * BLOCK_SIZE];
		int inputOffset = 3;
		int outputOffset = 0;
		for (int i = 0; i < blocks; i++) {
			processBlock(source, inputOffset, output, outputOffset);
			inputOffset += BLOCK_SIZE;
			outputOffset += BLOCK_SIZE;
		}
		final byte[] retval = new byte[length];
		System.arraycopy(output, 0, retval, 0, length);
		return retval;
	}

	public byte[] encrypt(final byte[] source) {
		return encrypt(source, 0, source.length);
	}

	public byte[] encrypt(final byte[] source, final int offset, final int length) {
		encrypting = true;

		final int blocks = (length / BLOCK_SIZE) + (length % BLOCK_SIZE != 0 ? 1 : 0);
		final byte[] output = new byte[3 + (blocks * BLOCK_SIZE)];
		final byte[] input = new byte[blocks * BLOCK_SIZE];
		System.arraycopy(source, offset, input, 0, length);
		for (int i = length; i < input.length; i++) {
			input[i] = 0;
		}
		int inputOffset = 0;
		int outputOffset = 3;
		output[0] = 1;
		output[1] = (byte) (length & 0x00FF);
		output[2] = (byte) (length >>> 8);
		for (int i = 0; i < blocks; i++) {
			processBlock(input, inputOffset, output, outputOffset);
			inputOffset += BLOCK_SIZE;
			outputOffset += BLOCK_SIZE;
		}
		return output;
	}

	/**
	 * Encrypt the given input starting at the given offset and place the result
	 * in the provided buffer starting at the given offset. The input will be an
	 * exact multiple of our blocksize.
	 * 
	 * encryptBlock uses the pre-calculated gSBox[] and subKey[] arrays.
	 */
	private void encryptBlock(byte[] src, int srcIndex, byte[] dst, int dstIndex) {
		int x0 = BytesTo32Bits(src, srcIndex) ^ gSubKeys[INPUT_WHITEN];
		int x1 = BytesTo32Bits(src, srcIndex + 4) ^ gSubKeys[INPUT_WHITEN + 1];
		int x2 = BytesTo32Bits(src, srcIndex + 8) ^ gSubKeys[INPUT_WHITEN + 2];
		int x3 = BytesTo32Bits(src, srcIndex + 12) ^ gSubKeys[INPUT_WHITEN + 3];

		int k = ROUND_SUBKEYS;
		int t0, t1;
		for (int r = 0; r < ROUNDS; r += 2) {
			t0 = Fe32_0(x0);
			t1 = Fe32_3(x1);
			x2 ^= t0 + t1 + gSubKeys[k++];
			x2 = x2 >>> 1 | x2 << 31;
			x3 = (x3 << 1 | x3 >>> 31) ^ (t0 + 2 * t1 + gSubKeys[k++]);

			t0 = Fe32_0(x2);
			t1 = Fe32_3(x3);
			x0 ^= t0 + t1 + gSubKeys[k++];
			x0 = x0 >>> 1 | x0 << 31;
			x1 = (x1 << 1 | x1 >>> 31) ^ (t0 + 2 * t1 + gSubKeys[k++]);
		}

		Bits32ToBytes(x2 ^ gSubKeys[OUTPUT_WHITEN], dst, dstIndex);
		Bits32ToBytes(x3 ^ gSubKeys[OUTPUT_WHITEN + 1], dst, dstIndex + 4);
		Bits32ToBytes(x0 ^ gSubKeys[OUTPUT_WHITEN + 2], dst, dstIndex + 8);
		Bits32ToBytes(x1 ^ gSubKeys[OUTPUT_WHITEN + 3], dst, dstIndex + 12);
	}

	/*
	 * TODO: This can be optimised and made cleaner by combining the
	 * functionality in this function and applying it appropriately to the
	 * creation of the subkeys during key setup.
	 */
	private final int F32(int x, int[] k32) {
		int b0 = b0(x);
		int b1 = b1(x);
		int b2 = b2(x);
		int b3 = b3(x);
		int k0 = k32[0];
		int k1 = k32[1];
		int k2 = k32[2];
		int k3 = k32[3];

		int result = 0;
		switch (k64Cnt & 3) {
		case 1:
			result = gMDS0[(P[P_01][b0] & 0xff) ^ b0(k0)] ^ gMDS1[(P[P_11][b1] & 0xff) ^ b1(k0)]
					^ gMDS2[(P[P_21][b2] & 0xff) ^ b2(k0)] ^ gMDS3[(P[P_31][b3] & 0xff) ^ b3(k0)];
			break;
		case 0: /* 256 bits of key */
			b0 = (P[P_04][b0] & 0xff) ^ b0(k3);
			b1 = (P[P_14][b1] & 0xff) ^ b1(k3);
			b2 = (P[P_24][b2] & 0xff) ^ b2(k3);
			b3 = (P[P_34][b3] & 0xff) ^ b3(k3);
		case 3:
			b0 = (P[P_03][b0] & 0xff) ^ b0(k2);
			b1 = (P[P_13][b1] & 0xff) ^ b1(k2);
			b2 = (P[P_23][b2] & 0xff) ^ b2(k2);
			b3 = (P[P_33][b3] & 0xff) ^ b3(k2);
		case 2:
			result = gMDS0[(P[P_01][(P[P_02][b0] & 0xff) ^ b0(k1)] & 0xff) ^ b0(k0)]
					^ gMDS1[(P[P_11][(P[P_12][b1] & 0xff) ^ b1(k1)] & 0xff) ^ b1(k0)]
					^ gMDS2[(P[P_21][(P[P_22][b2] & 0xff) ^ b2(k1)] & 0xff) ^ b2(k0)]
					^ gMDS3[(P[P_31][(P[P_32][b3] & 0xff) ^ b3(k1)] & 0xff) ^ b3(k0)];
			break;
		}
		return result;
	}

	private final int Fe32_0(int x) {
		return gSBox[0x000 + 2 * (x & 0xff)] ^ gSBox[0x001 + 2 * ((x >>> 8) & 0xff)]
				^ gSBox[0x200 + 2 * ((x >>> 16) & 0xff)] ^ gSBox[0x201 + 2 * ((x >>> 24) & 0xff)];
	}

	private final int Fe32_3(int x) {
		return gSBox[0x000 + 2 * ((x >>> 24) & 0xff)] ^ gSBox[0x001 + 2 * (x & 0xff)]
				^ gSBox[0x200 + 2 * ((x >>> 8) & 0xff)] ^ gSBox[0x201 + 2 * ((x >>> 16) & 0xff)];
	}

	public String getAlgorithmName() {
		return "Twofish";
	}

	public int getBlockSize() {
		return BLOCK_SIZE;
	}

	/**
	 * Initialise a Twofish cipher.
	 * 
	 * @param encrypting
	 *            Flag for encryption or decryption.
	 * @param key
	 *            The parameters required to set up the cipher.
	 * @exception IllegalArgumentException
	 *                if the params argument is inappropriate.
	 */
	public void init(boolean encrypting, byte[] key) {

		this.encrypting = encrypting;
		this.workingKey = key;
		this.k64Cnt = (this.workingKey.length / 8); // pre-padded ?
		setKey(this.workingKey);

		return;

	}

	private final int LFSR1(int x) {
		return (x >> 1) ^ (((x & 0x01) != 0) ? GF256_FDBK_2 : 0);
	}

	private final int LFSR2(int x) {
		return (x >> 2) ^ (((x & 0x02) != 0) ? GF256_FDBK_2 : 0) ^ (((x & 0x01) != 0) ? GF256_FDBK_4 : 0);
	}

	private final int Mx_X(int x) {
		return x ^ LFSR2(x);
	} // 5B

	private final int Mx_Y(int x) {
		return x ^ LFSR1(x) ^ LFSR2(x);
	} // EF

	/**
	 * 
	 * @param in
	 * @param inOff
	 * @param out
	 * @param outOff
	 * @return
	 */
	public final int processBlock(byte[] in, int inOff, byte[] out, int outOff) {
		if (workingKey == null) {
			throw new IllegalStateException("Twofish not initialised");
		}

		if ((inOff + BLOCK_SIZE) > in.length) {
			throw new IllegalArgumentException("input buffer too short");
		}

		if ((outOff + BLOCK_SIZE) > out.length) {
			throw new IllegalArgumentException("output buffer too short");
		}

		if (encrypting) {
			encryptBlock(in, inOff, out, outOff);
		} else {
			decryptBlock(in, inOff, out, outOff);
		}

		return BLOCK_SIZE;
	}

	public void reset() {
		if (this.workingKey != null) {
			setKey(this.workingKey);
		}
	}

	/**
	 * Use (12, 8) Reed-Solomon code over GF(256) to produce a key S-box 32-bit
	 * entity from 2 key material 32-bit entities.
	 * 
	 * @param k0
	 *            first 32-bit entity
	 * @param k1
	 *            second 32-bit entity
	 * @return Remainder polynomial generated using RS code
	 */
	private final int RS_MDS_Encode(int k0, int k1) {
		int r = k1;
		for (int i = 0; i < 4; i++) // shift 1 byte at a time
		{
			r = RS_rem(r);
		}
		r ^= k0;
		for (int i = 0; i < 4; i++) {
			r = RS_rem(r);
		}

		return r;
	}

	/**
	 * Reed-Solomon code parameters: (12,8) reversible code:
	 * <p>
	 * 
	 * <pre>
	 * g(x) = x&circ;4 + (a+1/a)x&circ;3 + ax&circ;2 + (a+1/a)x + 1
	 * </pre>
	 * 
	 * where a = primitive root of field generator 0x14D
	 */
	private final int RS_rem(int x) {
		int b = (x >>> 24) & 0xff;
		int g2 = ((b << 1) ^ ((b & 0x80) != 0 ? RS_GF_FDBK : 0)) & 0xff;
		int g3 = ((b >>> 1) ^ ((b & 0x01) != 0 ? (RS_GF_FDBK >>> 1) : 0)) ^ g2;
		return ((x << 8) ^ (g3 << 24) ^ (g2 << 16) ^ (g3 << 8) ^ b);
	}

	private void setKey(byte[] key) {
		int[] k32e = new int[MAX_KEY_BITS / 64]; // 4
		int[] k32o = new int[MAX_KEY_BITS / 64]; // 4

		int[] sBoxKeys = new int[MAX_KEY_BITS / 64]; // 4
		gSubKeys = new int[TOTAL_SUBKEYS];

		if (k64Cnt < 1) {
			throw new IllegalArgumentException("Key size less than 64 bits");
		}

		if (k64Cnt > 4) {
			throw new IllegalArgumentException("Key size larger than 256 bits");
		}

		/*
		 * k64Cnt is the number of 8 byte blocks (64 chunks) that are in the
		 * input key. The input key is a maximum of 32 bytes (256 bits), so the
		 * range for k64Cnt is 1..4
		 */
		for (int i = 0; i < k64Cnt; i++) {
			int p = i * 8;

			k32e[i] = BytesTo32Bits(key, p);
			k32o[i] = BytesTo32Bits(key, p + 4);

			sBoxKeys[k64Cnt - 1 - i] = RS_MDS_Encode(k32e[i], k32o[i]);
		}

		int q, A, B;
		for (int i = 0; i < TOTAL_SUBKEYS / 2; i++) {
			q = i * SK_STEP;
			A = F32(q, k32e);
			B = F32(q + SK_BUMP, k32o);
			B = B << 8 | B >>> 24;
			A += B;
			gSubKeys[i * 2] = A;
			A += B;
			gSubKeys[i * 2 + 1] = A << SK_ROTL | A >>> (32 - SK_ROTL);
		}

		/*
		 * fully expand the table for speed
		 */
		int k0 = sBoxKeys[0];
		int k1 = sBoxKeys[1];
		int k2 = sBoxKeys[2];
		int k3 = sBoxKeys[3];
		int b0, b1, b2, b3;
		gSBox = new int[4 * MAX_KEY_BITS];
		for (int i = 0; i < MAX_KEY_BITS; i++) {
			b0 = b1 = b2 = b3 = i;
			switch (k64Cnt & 3) {
			case 1:
				gSBox[i * 2] = gMDS0[(P[P_01][b0] & 0xff) ^ b0(k0)];
				gSBox[i * 2 + 1] = gMDS1[(P[P_11][b1] & 0xff) ^ b1(k0)];
				gSBox[i * 2 + 0x200] = gMDS2[(P[P_21][b2] & 0xff) ^ b2(k0)];
				gSBox[i * 2 + 0x201] = gMDS3[(P[P_31][b3] & 0xff) ^ b3(k0)];
				break;
			case 0: /* 256 bits of key */
				b0 = (P[P_04][b0] & 0xff) ^ b0(k3);
				b1 = (P[P_14][b1] & 0xff) ^ b1(k3);
				b2 = (P[P_24][b2] & 0xff) ^ b2(k3);
				b3 = (P[P_34][b3] & 0xff) ^ b3(k3);
			case 3:
				b0 = (P[P_03][b0] & 0xff) ^ b0(k2);
				b1 = (P[P_13][b1] & 0xff) ^ b1(k2);
				b2 = (P[P_23][b2] & 0xff) ^ b2(k2);
				b3 = (P[P_33][b3] & 0xff) ^ b3(k2);
			case 2:
				gSBox[i * 2] = gMDS0[(P[P_01][(P[P_02][b0] & 0xff) ^ b0(k1)] & 0xff) ^ b0(k0)];
				gSBox[i * 2 + 1] = gMDS1[(P[P_11][(P[P_12][b1] & 0xff) ^ b1(k1)] & 0xff) ^ b1(k0)];
				gSBox[i * 2 + 0x200] = gMDS2[(P[P_21][(P[P_22][b2] & 0xff) ^ b2(k1)] & 0xff) ^ b2(k0)];
				gSBox[i * 2 + 0x201] = gMDS3[(P[P_31][(P[P_32][b3] & 0xff) ^ b3(k1)] & 0xff) ^ b3(k0)];
				break;
			}
		}

		/*
		 * the function exits having setup the gSBox with the input key
		 * material.
		 */
	}
}
